Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects when a user is added to a group in Office 365.
Detects when a group GUID in Office 365 has more users added to it by the same user than a defined thresold.
Detects when a user is removed from a group in Office 365.
Detects when a user is removed from a group in Microsoft Teams.
This rule identifies when an external user account is added to a group within Google Workspace. This detection helps security teams monitor for unauthorized or unexpected additions of external users to internal groups, which could lead to unauthorized access to sensitive data or resources. The rule works by comparing the domain of the group with the domain of the user being added; if they differ, it indicates an external user is being added.
Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data. The rule specifically looks for `USER_RESOURCE_UPDATE_PERMISSIONS` events with `ASSIGN_ROLE` as the product event type and `DELEGATED_ADMIN_SETTINGS` in the security result category details. It also calculates a higher risk score if the assigned role is `_SEED_ADMIN_ROLE`.
This rule detects when a user is assigned 'Super user' privileges within the OneLogin SSO system. It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product is 'ONELOGIN_SSO', the vendor is 'ONELOGIN', the product event type indicates a permission grant (code 72), and the target resource name is 'Super user'. This indicates a significant privilege escalation within the identity provider.
Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.
Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
Detects the usage of the 'usermod' command to add a user to either the 'root' or 'sudoers' group on a Linux system. This activity can indicate privilege escalation or persistence mechanisms by an attacker.
Page 18 of 18